What does PacketLens do?
PacketLens opens packet captures on iPhone, iPad and Mac and decodes them like a desktop analyser: a packet list with protocol badges and filters, a full decode tree with hex, and request/answer flows. Its Trace view follows one subscriber or host through the whole capture and draws it as a ladder diagram, and you can export what you find with identities masked.
Which devices does it run on?
iPhone and iPad with iOS / iPadOS 26 or later, and Mac with macOS 26 or later.
Which file formats can I open?
.pcap and .pcapng. PacketLens recognises the format from the file’s contents.
It analyses capture files; it does not capture live traffic.
How do I open a capture on iPhone and on Mac?
iPhone and iPad: tap Open Capture on the Home screen and pick the file, or tap a capture in Files, Mail or Messages and choose PacketLens.
Mac: use File › Open… (or Open Recent), or double-click a capture file.
Are my captures uploaded anywhere?
No. Captures are decoded only on your device. PacketLens has no account, no analytics, advertising or tracking SDKs, and makes no network requests of its own. Files only leave your device when you export and share them yourself. See the Privacy Policy.
Which protocols are decoded?
The mobile core and IMS: S1AP / NAS, GTPv2-C and GTP-U, Diameter (S6a, Gx, Rx, Gy/Ro, Cx/Dx, Sh), MAP / TCAP and CAP over M3UA / SCCP, SIP / SDP, RTP / RTCP, plus DNS, DHCP and TLS, with IPv4, IPv6, TCP and SCTP reassembly underneath. See Features.
What is Trace? Subscribers vs Hosts.
Trace gathers everything a capture contains about one entity into a single story.
- Subscribers are mobile users, identified by IMSI, MSISDN or IMEI. PacketLens links their identities across S1AP / NAS, GTPv2, Diameter, MAP and SIP and flags failures such as rejects, error causes and unanswered requests.
- Hosts are IP addresses, with names learned from DNS, DHCP and TLS server names, and MAC addresses. A UE IP that belongs to a subscriber links to that subscriber.
Search by IMSI, MSISDN, IMEI, IP, MAC or host name, then tap View trace to see the identity header, the ladder diagram and the list of procedures.
Why does a message show “NAS (ciphered)”?
After NAS security is set up (Security Mode Command), NAS messages are usually encrypted on the wire, so
their contents can’t be decoded from the capture. PacketLens keeps them in the trace labelled
NAS (ciphered) instead of dropping them, and follows the subscriber through the S1AP UE IDs.
Null-ciphered (EEA0) NAS decodes normally.
I don’t work in telecom. Is it useful?
Yes. Any pcap or pcapng opens in the packet list with its decode tree and hex, and the Hosts view in Trace works on ordinary IP traffic: each host with its names from DNS, DHCP and TLS server names, its MAC address and the protocols it used, and a ladder of its DNS queries and TLS sessions.
How much does it cost, and what happens after the trial?
Free download. Start your 30-day free trial whenever you're ready, then CHF 2.60 once. No subscription. Every feature is included during the 30-day trial. The trial starts when you tap “Try everything free for 30 days” in the app, not when you download it.
When the trial ends, you can still open the bundled demo capture. Opening your own captures needs the one-time unlock. Nothing you created is deleted. The unlock is a one-time in-app purchase of CHF 2.60, and nothing is charged automatically. There are no tiers and no other purchases. Prices in other currencies are set by the App Store. See Pricing.
Do I need to buy it again for iPad, Mac or a new device?
No. PacketLens is one app for iPhone, iPad and Mac (a universal purchase), so one purchase covers every device signed in with the same Apple ID.
On a new device, sign in with that Apple ID, open PacketLens and tap Restore purchases.
I have an offer code. Where do I redeem it?
Open PacketLens and go to Settings › PacketLens Pro › Redeem Code.
How do I report a decoding bug?
Email us with the app version, the protocol and message type, what you expected to see, and a screenshot or a masked export. Never send captures with real subscriber data. See Support.